CVE-2026-109444: OpenSRE through 0.1.2026.10.19 Approval Gate Bypass via shell_run Prompt Injection
OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows attackers to execute shellrun commands without confirmation because the headless presenter's executionallowed() always returns True. Attackers can inject instructions into alerts or Slack messages triaged by the agent to run commands on the host and exfiltrate LLM, Slack and cloud credentials.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments where OpenSRE triages attacker-influenced alerts or Slack messages and can invoke shell_run on the host are exposed. An attacker can use injected instructions in those inputs to cause host command execution.
Does exploitation require an authenticated OpenSRE user or explicit command approval?
No OpenSRE privileges are required according to the supplied vector. The vulnerable headless presenter reports that execution is allowed, so shell_run commands can run without confirmation.
What could an attacker obtain after successful exploitation?
The issue can enable command execution on the host and exfiltration of LLM, Slack, and cloud credentials available to the agent or host environment.
How can I determine whether my deployment is affected?
OpenSRE versions through 0.1.2026.10.19 are affected. In particular, assess whether the deployment uses the headless presenter and processes untrusted alert or Slack message content.